GDPR (General Data Protection Regulation)
Markus (sign name) just started a new job.
On his first day, his supervisor tells him that he has to take care
to adhere to GDPR when carrying out his tasks
and particularly when working with data from the company’s customers.
Markus is familiar with the abbreviation
but doesn’t know what it stands for …
Don’t worry, Markus.
Let’s have a look at GDPR together
and see what it means for companies and individuals!
The General Data Protection Regulation (GDPR)
is a privacy and security law.
It applies to any organisation that collects data from people
living in the European Union.
GDPR has many sections:
- It recognises the privacy rights of individuals.
hat means that your private data must be kept private
and not shared publically.
- It specifies when and why organisations
can collect and process personal data
(for example your name, e-mail address, date of birth, …)
- It determines that companies need your consent (that means agreement)
to collect your data.
- It outlines the responsibilities that organisations must follow
when processing data.
- It details how organisations must keep to laws and regulations
concerning data processing
and integrate GDPR
into current and future activities.
What does GDPR mean for me as an individual?
GDPR gives individuals more control over the data
they give to organisations.
It recognises specific rights with regard to data privacy:
1. The right to be informed
if your data is being collected and processed.
2. The right to information about what data is being processed.
3. The right to information about the legal basis
of the data processing.
This means: What laws allow your data to be processed?
4. The right to request corrections to your data.
5. The right to make organisations
stop using your data
and delete it completely.
6. The right to obtain a copy of your data
that can be used with other service providers (including competitors).
What does GDPR mean for organisations?
Organisations are only allowed to process personal data
under particular conditions.
Processing is allowed if the individual gives consent to do so
or if it is necessary under specific conditions.
Examples for such conditions are:
An organisation is allowed to process your data
if you enter into a contract with them.
A company is allowed to process your data
if it is a legal obligation
for example following a court order.
A company is allowed to process your data
to perform a task in the public interest
(such as carrying out work for a private rubbish collection company).
GDPR applies to organisations anywhere in the world
world that process data belonging to people in the EU.
Any organisation that does not comply with GDPR
can be fined up to 20 million Euros,
or 4% of their annual worldwide income.
Markus now knows what GDPR stands for
and has a basic overview.
Next time, he will ask his supervisor
about how exactly his company is applying GDPR.